For the first time in over 11 years, significant changes are proposed to the Security Rule component of the Health Insurance Portability and Accountability Act (HIPAA). In a Proposed Rule published today, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) aims to address the massive spike in cybersecurity incidents and breaches involving protected health information, and the glaring compliance deficiencies observed by OCR related to the Security Rule. 
 
The HIPAA Security Rule was created in the late 1990s and early 2000s in the age of the PalmPilot, dial-up internet, and much fewer cybersecurity threats, so OCR is “modernizing” the Security Rule to align with today’s security environment.  The current Security Rule is also very flexible - lacking precise safeguard requirements in the regulations.  These proposed changes signify a stark shift to more explicit and absolute mandates requiring ambulance services and their business associates to take a hard look at their existing security if implemented. 
 
Comments to the Proposed Rule are due March 7, 2025.  PWW is also monitoring another Proposed Rule issued in 2021 containing several proposed changes to the HIPAA Privacy Rule. OCR may issue a more extensive, consolidated “Omnibus Rule” containing both the Security and Privacy Rule updates simultaneously - stay tuned.